bmad-plus 0.9.0 → 0.9.2

package/src/bmad-plus/packs/pack-shield/references/gdpr-compliance/dpa-template.md

@@ -1,121 +1,121 @@
-# Data Processing Agreement (DPA) Template
-
-## Legal Basis
-Art. 28 GDPR — processors must be bound by a contract covering all mandatory Art. 28(3) terms.
-Failure to have a compliant DPA is itself a violation exposable to Art. 83(4) fines (up to €10M / 2% turnover).
-
----
-
-## Parties
-
-**Controller**: [CONTROLLER LEGAL NAME], [ADDRESS] ("Controller")
-**Processor**: [PROCESSOR LEGAL NAME], [ADDRESS] ("Processor")
-
----
-
-## 1. Subject Matter and Duration (Art. 28(3))
-This DPA governs the processing of personal data by Processor on behalf of Controller in
-connection with: [DESCRIPTION OF MAIN SERVICE / CONTRACT].
-
-Duration: This DPA is co-terminus with the main service agreement dated [DATE].
-
-## 2. Nature and Purpose of Processing (Art. 28(3))
-The Processor will process personal data for the following purposes only:
-- [e.g. Hosting and storing Controller's application data]
-- [e.g. Sending transactional emails on Controller's instruction]
-
-Processing shall occur only on documented instructions from the Controller (Art. 28(3)(a)).
-
-## 3. Categories of Personal Data (Art. 28(3))
-The following categories of personal data are covered by this DPA:
-- [e.g. Contact data: name, email address, phone number]
-- [e.g. Usage data: IP address, session identifiers]
-- [List any special category data + confirm Art. 9 condition met]
-
-## 4. Categories of Data Subjects (Art. 28(3))
-- [e.g. Controller's end users / customers]
-- [e.g. Controller's employees]
-
-## 5. Processor Obligations (Art. 28(3))
-
-### 5.1 Instructions Only (Art. 28(3)(a))
-Processor shall process personal data only on documented instructions from Controller, including
-with regard to transfers, unless required by law (in which case Processor shall notify Controller
-unless prohibited).
-
-### 5.2 Confidentiality (Art. 28(3)(b))
-Processor shall ensure that persons authorised to process the data have committed to
-confidentiality or are under a statutory obligation of confidentiality.
-
-### 5.3 Security (Art. 28(3)(c); Art. 32)
-Processor shall implement appropriate technical and organisational measures including at minimum:
-- Encryption of personal data at rest and in transit
-- Ongoing confidentiality, integrity, and availability of processing systems
-- Ability to restore availability following incidents
-- Regular testing of security measures
-
-### 5.4 Sub-processors (Art. 28(2), 28(3)(d))
-Processor shall not engage sub-processors without prior **specific or general written authorisation**
-from Controller.
-
-Current authorised sub-processors: [LIST or "See Schedule A"]
-
-Processor shall impose equivalent data protection obligations on sub-processors (Art. 28(4)) and
-remains liable to Controller for sub-processor failures.
-
-### 5.5 Data Subject Rights (Art. 28(3)(e))
-Processor shall assist Controller by appropriate technical and organisational measures to fulfil
-Controller's obligation to respond to data subject rights requests (Arts. 15–22), given the nature
-of processing.
-
-### 5.6 Assistance with Controller Obligations (Art. 28(3)(f))
-Processor shall assist Controller in ensuring compliance with: Art. 32 (security), Art. 33–34
-(breach notification), Art. 35–36 (DPIAs), taking into account the nature of processing and
-information available.
-
-### 5.7 Deletion or Return (Art. 28(3)(g))
-At Controller's choice, Processor shall delete or return all personal data upon termination of
-services, and delete existing copies unless Union or Member State law requires storage.
-Timeline for deletion/return: [X days after termination].
-
-### 5.8 Audit Rights (Art. 28(3)(h))
-Processor shall make available all information necessary to demonstrate compliance with Art. 28
-and shall allow for and contribute to audits conducted by Controller or an authorised auditor.
-Audit notice period: [X days]. Frequency: [no more than once per year absent cause].
-
-## 6. International Transfers (Art. 44–49)
-[If applicable:]
-Where Processor transfers personal data outside the UK/EEA, the following safeguard applies:
-- [ ] Adequacy decision (Art. 45): [COUNTRY]
-- [ ] Standard Contractual Clauses (Art. 46(2)(c)): [MODULE — attach as Schedule B]
-- [ ] Binding Corporate Rules (Art. 47)
-- [ ] Other: [SPECIFY]
-
-## 7. Breach Notification (Art. 33)
-Processor shall notify Controller of any personal data breach **without undue delay** and in any
-event within **[48/72] hours** of becoming aware, providing information per Art. 33(3) to the
-extent available.
-
-## 8. Governing Law
-This DPA is governed by the laws of [JURISDICTION].
-
----
-
-## Schedule A — Authorised Sub-processors
-| Sub-processor | Location | Processing Activity |
-|--------------|----------|-------------------|
-| [NAME] | [COUNTRY] | [PURPOSE] |
-
-## Schedule B — Standard Contractual Clauses
-[Attach EU Commission SCCs (2021) or UK IDTA as applicable]
-
----
-
-## Drafting Checklist
-- [ ] All Art. 28(3)(a)–(h) clauses present
-- [ ] Sub-processor list attached or mechanism described
-- [ ] Transfer mechanism documented and attached
-- [ ] Breach notification timeline specified
-- [ ] Deletion timeline specified
-- [ ] Audit rights defined with reasonable notice period
-- [ ] Signed by authorised representatives of both parties
+# Data Processing Agreement (DPA) Template
+
+## Legal Basis
+Art. 28 GDPR — processors must be bound by a contract covering all mandatory Art. 28(3) terms.
+Failure to have a compliant DPA is itself a violation exposable to Art. 83(4) fines (up to €10M / 2% turnover).
+
+---
+
+## Parties
+
+**Controller**: [CONTROLLER LEGAL NAME], [ADDRESS] ("Controller")
+**Processor**: [PROCESSOR LEGAL NAME], [ADDRESS] ("Processor")
+
+---
+
+## 1. Subject Matter and Duration (Art. 28(3))
+This DPA governs the processing of personal data by Processor on behalf of Controller in
+connection with: [DESCRIPTION OF MAIN SERVICE / CONTRACT].
+
+Duration: This DPA is co-terminus with the main service agreement dated [DATE].
+
+## 2. Nature and Purpose of Processing (Art. 28(3))
+The Processor will process personal data for the following purposes only:
+- [e.g. Hosting and storing Controller's application data]
+- [e.g. Sending transactional emails on Controller's instruction]
+
+Processing shall occur only on documented instructions from the Controller (Art. 28(3)(a)).
+
+## 3. Categories of Personal Data (Art. 28(3))
+The following categories of personal data are covered by this DPA:
+- [e.g. Contact data: name, email address, phone number]
+- [e.g. Usage data: IP address, session identifiers]
+- [List any special category data + confirm Art. 9 condition met]
+
+## 4. Categories of Data Subjects (Art. 28(3))
+- [e.g. Controller's end users / customers]
+- [e.g. Controller's employees]
+
+## 5. Processor Obligations (Art. 28(3))
+
+### 5.1 Instructions Only (Art. 28(3)(a))
+Processor shall process personal data only on documented instructions from Controller, including
+with regard to transfers, unless required by law (in which case Processor shall notify Controller
+unless prohibited).
+
+### 5.2 Confidentiality (Art. 28(3)(b))
+Processor shall ensure that persons authorised to process the data have committed to
+confidentiality or are under a statutory obligation of confidentiality.
+
+### 5.3 Security (Art. 28(3)(c); Art. 32)
+Processor shall implement appropriate technical and organisational measures including at minimum:
+- Encryption of personal data at rest and in transit
+- Ongoing confidentiality, integrity, and availability of processing systems
+- Ability to restore availability following incidents
+- Regular testing of security measures
+
+### 5.4 Sub-processors (Art. 28(2), 28(3)(d))
+Processor shall not engage sub-processors without prior **specific or general written authorisation**
+from Controller.
+
+Current authorised sub-processors: [LIST or "See Schedule A"]
+
+Processor shall impose equivalent data protection obligations on sub-processors (Art. 28(4)) and
+remains liable to Controller for sub-processor failures.
+
+### 5.5 Data Subject Rights (Art. 28(3)(e))
+Processor shall assist Controller by appropriate technical and organisational measures to fulfil
+Controller's obligation to respond to data subject rights requests (Arts. 15–22), given the nature
+of processing.
+
+### 5.6 Assistance with Controller Obligations (Art. 28(3)(f))
+Processor shall assist Controller in ensuring compliance with: Art. 32 (security), Art. 33–34
+(breach notification), Art. 35–36 (DPIAs), taking into account the nature of processing and
+information available.
+
+### 5.7 Deletion or Return (Art. 28(3)(g))
+At Controller's choice, Processor shall delete or return all personal data upon termination of
+services, and delete existing copies unless Union or Member State law requires storage.
+Timeline for deletion/return: [X days after termination].
+
+### 5.8 Audit Rights (Art. 28(3)(h))
+Processor shall make available all information necessary to demonstrate compliance with Art. 28
+and shall allow for and contribute to audits conducted by Controller or an authorised auditor.
+Audit notice period: [X days]. Frequency: [no more than once per year absent cause].
+
+## 6. International Transfers (Art. 44–49)
+[If applicable:]
+Where Processor transfers personal data outside the UK/EEA, the following safeguard applies:
+- [ ] Adequacy decision (Art. 45): [COUNTRY]
+- [ ] Standard Contractual Clauses (Art. 46(2)(c)): [MODULE — attach as Schedule B]
+- [ ] Binding Corporate Rules (Art. 47)
+- [ ] Other: [SPECIFY]
+
+## 7. Breach Notification (Art. 33)
+Processor shall notify Controller of any personal data breach **without undue delay** and in any
+event within **[48/72] hours** of becoming aware, providing information per Art. 33(3) to the
+extent available.
+
+## 8. Governing Law
+This DPA is governed by the laws of [JURISDICTION].
+
+---
+
+## Schedule A — Authorised Sub-processors
+| Sub-processor | Location | Processing Activity |
+|--------------|----------|-------------------|
+| [NAME] | [COUNTRY] | [PURPOSE] |
+
+## Schedule B — Standard Contractual Clauses
+[Attach EU Commission SCCs (2021) or UK IDTA as applicable]
+
+---
+
+## Drafting Checklist
+- [ ] All Art. 28(3)(a)–(h) clauses present
+- [ ] Sub-processor list attached or mechanism described
+- [ ] Transfer mechanism documented and attached
+- [ ] Breach notification timeline specified
+- [ ] Deletion timeline specified
+- [ ] Audit rights defined with reasonable notice period
+- [ ] Signed by authorised representatives of both parties

package/src/bmad-plus/packs/pack-shield/references/gdpr-compliance/privacy-notice.md

@@ -1,87 +1,87 @@
-# Privacy Notice / Privacy Policy Template
-
-## Legal Basis
-Arts. 13–14 (information to be provided), Art. 12 (transparent communication).
-Art. 13 applies when data collected directly from subject; Art. 14 when collected indirectly.
-
----
-
-## Required Sections (Art. 13/14 Checklist)
-
-### 1. Identity and Contact Details of the Controller (Art. 13(1)(a))
-> **[ORGANISATION NAME]** ("we", "us", "our")
-> Registered address: [ADDRESS]
-> Email: [PRIVACY@EMAIL.COM]
-
-### 2. DPO Contact Details (Art. 13(1)(b)) — if applicable
-> Our Data Protection Officer can be contacted at: [DPO EMAIL / ADDRESS]
-
-### 3. Purposes and Lawful Basis (Art. 13(1)(c))
-For each processing activity, state both purpose AND lawful basis:
-
-| Purpose | Personal Data | Lawful Basis (Art. 6) |
-|---------|--------------|----------------------|
-| [e.g. Account creation] | [Name, email] | Contract (Art. 6(1)(b)) |
-| [e.g. Marketing emails] | [Email, preferences] | Consent (Art. 6(1)(a)) |
-| [e.g. Fraud prevention] | [Transaction data] | Legitimate interests (Art. 6(1)(f)) |
-
-Where legitimate interests is relied upon, summarise the LIA outcome.
-
-### 4. Legitimate Interests (Art. 13(1)(d)) — where applicable
-> We process [DATA] for [PURPOSE] based on our legitimate interest in [INTEREST]. We have
-> assessed that this interest is not overridden by your rights and interests because [REASON].
-
-### 5. Recipients or Categories of Recipients (Art. 13(1)(e))
-> We share your personal data with:
-> - [SERVICE PROVIDER / PROCESSOR NAME]: for [PURPOSE], located in [COUNTRY]
-> - [ANALYTICS PROVIDER]: for [PURPOSE]
-> We do not sell your personal data to third parties.
-
-### 6. International Transfers (Art. 13(1)(f))
-> Where we transfer data outside the UK/EEA, we ensure appropriate safeguards are in place,
-> including: [Adequacy decision / Standard Contractual Clauses (SCCs) / BCRs — Art. 46].
-> Details available on request.
-
-### 7. Retention Period (Art. 13(2)(a))
-> We retain your personal data for [PERIOD / criteria used to determine period].
-> See our Retention Schedule for full details.
-
-### 8. Data Subject Rights (Art. 13(2)(b))
-> You have the right to:
-> - **Access** your data (Art. 15) — request a copy of data we hold about you
-> - **Rectification** of inaccurate data (Art. 16)
-> - **Erasure** ("right to be forgotten") in certain circumstances (Art. 17)
-> - **Restrict** our processing in certain circumstances (Art. 18)
-> - **Data portability** for data provided by you under consent or contract (Art. 20)
-> - **Object** to processing based on legitimate interests or direct marketing (Art. 21)
-> - **Withdraw consent** at any time without affecting prior processing (Art. 7(3))
->
-> To exercise your rights, contact: [EMAIL / FORM URL]
-> We will respond within **one month** (Art. 12(3)), extendable by two further months for
-> complex requests.
-
-### 9. Right to Lodge a Complaint (Art. 13(2)(d))
-> You have the right to lodge a complaint with your supervisory authority.
-> In the UK: **ICO** — ico.org.uk | 0303 123 1113
-> In the EU: [LEAD SUPERVISORY AUTHORITY if applicable]
-
-### 10. Whether Provision is Statutory/Contractual (Art. 13(2)(e))
-> [Where applicable: "Providing this data is a contractual requirement. Failure to provide it
-> may mean we cannot [provide the service]."]
-
-### 11. Automated Decision-Making / Profiling (Art. 13(2)(f))
-> [If applicable: "We use automated decision-making including profiling for [PURPOSE].
-> This has [significant / no significant] effect on you. You have the right to [request human
-> review / object — Art. 22]."]
-> [If not applicable: "We do not use automated decision-making that produces legal or similarly
-> significant effects on you."]
-
----
-
-## Drafting Checklist
-- [ ] Written in plain, clear language (Art. 12(1))
-- [ ] Provided free of charge (Art. 12(5))
-- [ ] All Art. 13(1) and 13(2) fields covered
-- [ ] Separate sections for each processing purpose
-- [ ] Version date and review schedule included
-- [ ] Accessible format (e.g., layered notice for website)
+# Privacy Notice / Privacy Policy Template
+
+## Legal Basis
+Arts. 13–14 (information to be provided), Art. 12 (transparent communication).
+Art. 13 applies when data collected directly from subject; Art. 14 when collected indirectly.
+
+---
+
+## Required Sections (Art. 13/14 Checklist)
+
+### 1. Identity and Contact Details of the Controller (Art. 13(1)(a))
+> **[ORGANISATION NAME]** ("we", "us", "our")
+> Registered address: [ADDRESS]
+> Email: [PRIVACY@EMAIL.COM]
+
+### 2. DPO Contact Details (Art. 13(1)(b)) — if applicable
+> Our Data Protection Officer can be contacted at: [DPO EMAIL / ADDRESS]
+
+### 3. Purposes and Lawful Basis (Art. 13(1)(c))
+For each processing activity, state both purpose AND lawful basis:
+
+| Purpose | Personal Data | Lawful Basis (Art. 6) |
+|---------|--------------|----------------------|
+| [e.g. Account creation] | [Name, email] | Contract (Art. 6(1)(b)) |
+| [e.g. Marketing emails] | [Email, preferences] | Consent (Art. 6(1)(a)) |
+| [e.g. Fraud prevention] | [Transaction data] | Legitimate interests (Art. 6(1)(f)) |
+
+Where legitimate interests is relied upon, summarise the LIA outcome.
+
+### 4. Legitimate Interests (Art. 13(1)(d)) — where applicable
+> We process [DATA] for [PURPOSE] based on our legitimate interest in [INTEREST]. We have
+> assessed that this interest is not overridden by your rights and interests because [REASON].
+
+### 5. Recipients or Categories of Recipients (Art. 13(1)(e))
+> We share your personal data with:
+> - [SERVICE PROVIDER / PROCESSOR NAME]: for [PURPOSE], located in [COUNTRY]
+> - [ANALYTICS PROVIDER]: for [PURPOSE]
+> We do not sell your personal data to third parties.
+
+### 6. International Transfers (Art. 13(1)(f))
+> Where we transfer data outside the UK/EEA, we ensure appropriate safeguards are in place,
+> including: [Adequacy decision / Standard Contractual Clauses (SCCs) / BCRs — Art. 46].
+> Details available on request.
+
+### 7. Retention Period (Art. 13(2)(a))
+> We retain your personal data for [PERIOD / criteria used to determine period].
+> See our Retention Schedule for full details.
+
+### 8. Data Subject Rights (Art. 13(2)(b))
+> You have the right to:
+> - **Access** your data (Art. 15) — request a copy of data we hold about you
+> - **Rectification** of inaccurate data (Art. 16)
+> - **Erasure** ("right to be forgotten") in certain circumstances (Art. 17)
+> - **Restrict** our processing in certain circumstances (Art. 18)
+> - **Data portability** for data provided by you under consent or contract (Art. 20)
+> - **Object** to processing based on legitimate interests or direct marketing (Art. 21)
+> - **Withdraw consent** at any time without affecting prior processing (Art. 7(3))
+>
+> To exercise your rights, contact: [EMAIL / FORM URL]
+> We will respond within **one month** (Art. 12(3)), extendable by two further months for
+> complex requests.
+
+### 9. Right to Lodge a Complaint (Art. 13(2)(d))
+> You have the right to lodge a complaint with your supervisory authority.
+> In the UK: **ICO** — ico.org.uk | 0303 123 1113
+> In the EU: [LEAD SUPERVISORY AUTHORITY if applicable]
+
+### 10. Whether Provision is Statutory/Contractual (Art. 13(2)(e))
+> [Where applicable: "Providing this data is a contractual requirement. Failure to provide it
+> may mean we cannot [provide the service]."]
+
+### 11. Automated Decision-Making / Profiling (Art. 13(2)(f))
+> [If applicable: "We use automated decision-making including profiling for [PURPOSE].
+> This has [significant / no significant] effect on you. You have the right to [request human
+> review / object — Art. 22]."]
+> [If not applicable: "We do not use automated decision-making that produces legal or similarly
+> significant effects on you."]
+
+---
+
+## Drafting Checklist
+- [ ] Written in plain, clear language (Art. 12(1))
+- [ ] Provided free of charge (Art. 12(5))
+- [ ] All Art. 13(1) and 13(2) fields covered
+- [ ] Separate sections for each processing purpose
+- [ ] Version date and review schedule included
+- [ ] Accessible format (e.g., layered notice for website)